Check your readiness
Firewall · Fortinet

Fortinet FortiGate settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to FortiOS 7.6 and 8.0 (paths checked against Fortinet documentation).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A FortiGate meets the Cyber Essentials firewall control when the default admin password is changed, administrative access from the internet is disabled or protected by MFA or trusted hosts, inbound policies are deny by default with each allowed service documented, and FortiOS is updated within 14 days of any critical or high-risk fix.

Key facts
Platform
Fortinet FortiGate (Fortinet)
Applies to
FortiOS 7.6 and 8.0 (paths checked against Fortinet documentation)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
13 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Fortinet FortiGate for firewalls?

Apply 5 settings in Fortinet FortiGate: change the admin password and enforce a length policy, disable administrative access on the WAN interface, restrict any remaining admin access with trusted hosts and MFA, confirm inbound is deny by default and document each policy and review rules at least annually. Together they provide evidence for A4.2, A4.2.1, A4.3, A4.9, A4.10, A4.11, A4.7, A4.8, A4.5 and A4.6.

Boundary firewall questions A4.1 to A4.11 map directly to FortiGate administration and policy settings. The management interface matters most: Fortinet's own PSIRT has published critical authentication bypass advisories for internet-exposed FortiOS admin interfaces, such as FG-IR-24-535 (CVE-2024-55591). See the firewalls requirements for what the control asks.

  1. Change the admin password and enforce a length policy

    A4.2A4.2.1A4.3
    System > Administrators > edit admin > Change Password; System > Settings > Password Policy: Password scope Admin, Minimum length 12 (CLI: config system password-policy > set status enable > set apply-to admin-password > set minimum-length 12)

    Leave the character requirements and password expiration off; v3.3 asks for length, MFA or a deny list, not character rules. Twelve characters meets option C of A4.3 on its own.

  2. Disable administrative access on the WAN interface

    A4.9A4.10
    Network > Interfaces > wan1 > Administrative Access: untick HTTPS, HTTP, SSH, FMG-Access and PING unless documented

    If you need remote management, connect over an IPsec VPN or use FortiGate Cloud rather than an open admin port.

  3. Restrict any remaining admin access with trusted hosts and MFA

    A4.11
    System > Administrators > edit each admin > Restrict login to trusted hosts: add up to ten IP addresses or subnets; Two-factor Authentication: on, Authentication Type FortiToken, Email or SMS

    Trusted hosts only restrict the interfaces once every administrator account has them set, so add them to all accounts, not just one.

  4. Confirm inbound is deny by default and document each policy

    A4.7A4.8
    Policy & Objects > Firewall Policy > check the Implicit Deny at the bottom of each sequence; add Comments to every WAN-to-LAN policy and Virtual IP with the business need, approver and date

  5. Review rules at least annually

    A4.5A4.6
    Policy & Objects > Firewall Policy > add the Hit Count and Last Used columns; remove unused rules, export the table and record the review date

A5: how do you configure Fortinet FortiGate for secure configuration?

Apply 2 settings in Fortinet FortiGate: remove unused administrator accounts and disable unused services and features. Together they provide evidence for A5.2, A7.3 and A5.1.

Remove unused accounts and services on the firewall itself. See the secure configuration requirements for what the control asks.

  1. Remove unused administrator accounts

    A5.2A7.3
    System > Administrators > delete entries for people who no longer administer the device

  2. Disable unused services and features

    A5.1
    Network > Interfaces > each interface > Administrative Access: untick protocols you do not use; remove unused VPN tunnels and portals, including Agentless VPN (formerly SSL VPN web mode)

A6: how do you configure Fortinet FortiGate for security update management?

Apply 3 settings in Fortinet FortiGate: check and apply firmware updates, enable automatic patch upgrades and subscribe to PSIRT advisories. Together they provide evidence for A6.4, A6.1, A6.4.1 and A6.4.2.

A6.4 covers router and firewall firmware explicitly. Critical or high-risk FortiOS fixes must be installed within 14 days, and the device must run a FortiOS branch Fortinet still supports. See the security update management requirements for what the control asks.

  1. Check and apply firmware updates

    A6.4AUTO-FAILA6.1
    System > Firmware & Registration > select the FortiGate > Upgrade > Select Firmware: Recommended or All Upgrades > Follow upgrade path

  2. Enable automatic patch upgrades

    A6.4.1
    System > Firmware & Registration > automatic firmware upgrade: enable (or CLI: config system fortiguard > set auto-firmware-upgrade enable)

    Automatic upgrades stay within the current minor release, so 7.6.x only moves to a later 7.6.x. Upgrades such as 7.4 to 7.6 are still manual. FortiOS 7.6.1 and later enable automatic upgrades by default, but they cannot be enabled on a FortiGate managed by FortiManager or belonging to a Security Fabric.

  3. Subscribe to PSIRT advisories

    A6.4.2
    fortiguard.com/psirt: check the advisories at least weekly; log each advisory rated critical or high (or CVSS v3 7.0 or above) with the date you patched

A7: how do you configure Fortinet FortiGate for user access control?

Apply 2 settings in Fortinet FortiGate: one named account per administrator and set login lockout. Together they provide evidence for A7.2, A7.5, A7.8 and A7.10.

Administrator accounts on the firewall are administrative accounts under A7. See the user access control requirements for what the control asks.

  1. One named account per administrator

    A7.2A7.5A7.8
    System > Administrators > Create New > Administrator > one account per person; Administrator profile: super_admin only where needed, prof_admin or a custom read-only profile otherwise

  2. Set login lockout

    A7.10
    CLI: config system global > set admin-lockout-threshold 5 > set admin-lockout-duration 300

    The threshold accepts 1 to 10 and defaults to 3, so the default already meets the 10-attempt limit. Record the value.

A8: how do you configure Fortinet FortiGate for malware protection?

Apply 1 setting in Fortinet FortiGate: apply antivirus and web filtering to outbound policies. Together they provide evidence for A8.3.

Gateway antivirus and web filtering support A8.3, but endpoint protection on each device is still required for A8.1. See the malware protection requirements for what the control asks.

  1. Apply antivirus and web filtering to outbound policies

    A8.3
    Security Profiles > AntiVirus and Web Filter > apply both profiles to LAN-to-WAN firewall policies

Which questions does this guide cover?

The 22 questions below are the ones Fortinet FortiGate can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.10If you answered yes in question A4.9, is there a documented business requirement for this access?A4: Disable administrative access on the WAN interface
A4.11If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?A4: Restrict any remaining admin access with trusted hosts and MFA
A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it.A4: Change the admin password and enforce a length policy
A4.2.1Please describe the process for changing your firewall password.A4: Change the admin password and enforce a length policy
A4.3How is your firewall password configured?A4: Change the admin password and enforce a length policy
A4.5Do you have a process to manage your firewall?A4: Review rules at least annually
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Review rules at least annually
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Confirm inbound is deny by default and document each policy
A4.8Please describe how you approve and document your allowed inbound connections.A4: Confirm inbound is deny by default and document each policy
A4.9Are your boundary firewalls configured to allow access to their configuration settings over the internet?A4: Disable administrative access on the WAN interface
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Disable unused services and features
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Remove unused administrator accounts
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Check and apply firmware updates
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Check and apply firmware updates
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Enable automatic patch upgrades
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Subscribe to PSIRT advisories
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Set login lockout
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A7: One named account per administrator
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A5: Remove unused administrator accounts
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: One named account per administrator
A7.8Do you formally track which users have administrator accounts in your organisation?A7: One named account per administrator
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Apply antivirus and web filtering to outbound policies

What evidence should you keep for the assessor?

Keep the 4 dated records listed below for Fortinet FortiGate. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Export of the firewall policy table with comments, hit counts and the review date.
  • Screenshot of WAN interface administrative access settings.
  • Administrator list with profiles, trusted hosts and two-factor status.
  • Firmware version, upgrade history and the PSIRT patch log with dates.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Only if the administrative interface is reachable from the internet. With WAN administrative access disabled, A4.9 is answered no and A4.10 and A4.11 do not apply. If you keep it open, you need a documented business need and either MFA (FortiToken) or a trusted-host IP allow list combined with a properly managed password.

Within 14 days of release for any fix the vendor rates critical or high, or that scores CVSS v3 7.0 or above, or where no severity is given. A6.4 names firewall firmware, and a No is an automatic fail. Fortinet PSIRT advisories carry a severity and CVSS score, so use them as your trigger.

Yes. Test case 1 is a remote vulnerability scan of your internet-facing IP addresses, which includes the FortiGate's WAN interface. An admin page or VPN portal running a FortiOS version with a vulnerability scored 7.0 or more fails it, whatever the age of the fix.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources